[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Minimum Security Requirements for Federal Information and Information Systems:

The minimum security requirements cover seventeen security-related areas with regard to protecting the confidentiality, integrity, and availability of federal information systems and the information processed, stored, and transmitted by those systems.  The security-related areas include: (i) access control; (ii) awareness and training; (iii) audit and accountability; (iv) certification, accreditation, and security assessments; (v) configuration management; (vi) contingency planning; (vii) identification and authentication; (viii) incident response; (ix) maintenance; (x) media protection; (xi) physical and environmental protection; (xii) planning; (xiii) personnel security; (xiv) risk assessment; (xv) systems and services acquisition; (xvi) system and communications protection; and (xvii) system and information integrity.  The seventeen areas represent a broad-based, balanced information security program that addresses the management, operational, and technical aspects of protecting federal information and information systems.

Identification and Authentication (IA): Organizations must identify information system users, processes acting on behalf of users, or devices and authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.

AUTHENTICATION: Verifying the identity of a user, process, or device, often as a prerequisite to allowing access to resources in an information system.

Minimum Security Requirements for Federal Information and Information Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines provide? (Part 5)

[Assistant]
osure Notice

NOTICE: ITL has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL.
However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication. As of the date of publication and following call(s) for the identification of patent claims whose use may be required for compliance with the guidance or requirements of this publication, no such patent claims have been identified to ITL. No representation is made or implied by ITL that licenses are not required to avoid patent infringement in the use of this publication. ## Table of Contents

| Executive Summary............................................................................................................................1        |
|-------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1. Introduction...................................................................................................................................2   |
| 2. Software Supply Chain (SSC) -Definition and Model .....................................................................4                           |
| 2.4.1. Software Supply Chain Defects ....................................................................................................6            |
| 2.4.2. Software Supply Chain Attacks.....................................................................................................6            |
| SSC Security -Risk Factors and Mitigation Measures .....................................................................8                             |
| 3. |
| 3.1.1.

Strategies for the Integration of Software Supply Chain Security in DevSecOps CI_CD Pipelines

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Supply Chain Risk Management
Configuration Management
Maintenance
Security Assessment
System and Communications Protection
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Computer Security Division 2003 Annual Report:

F or many years, the Computer Security Division has made great contributions to help secure our nation's sensitive information and information systems. Our work has paralleled the evolution of  IT , initially  focused  principally  on  mainframe  computers, to now encompass today's wide gamut of information technology devices. Our important responsibilities were re-affirmed by Congress with passage of the Federal Information Security Management Act (FISMA) of 2002 and the Cyber Security Research and Development Act of 2002.

Our  key  2003  accomplishments  include  advancing  development  of  our cryptographic standards toolkit, our E-authentication work, our management and technical security guidelines, and expanding our Cryptographic Module Validation Program. Our research efforts include advancing development  of  (1)  better  means  of  access  controls, (2)  means  to  secure personal digital assistants, and (3) specifications to promote smart card

different engineering disciplines, computer programming, systems  analysis, and  mathematics; management  positions; information technology  auditing; legal  experience  (two Board  members  are  attorneys); an  extensive history of professional publications; and professional  journalism. Members  have  worked (and in many cases, are continuing to work in their  full  time  jobs)  on  the  development  and evolution of some of the most important pieces of  information  security  and  privacy  in  the Federal  Government, including  the  Privacy Act of 1974, the Computer Security Act of 1987, the Federal  Public  Key  Infrastructure  (PKI)  effort, and  numerous  e-Government  services  and initiatives.

Computer Security Division 2003 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Control Baselines for Information Systems and Organizations:

See [SP 800-37], Task S-2, Control Tailoring, for additional guidance on tailoring control baselines for systems and environments of operation.' | 9 | | 12-10-2020 | Editorial | Section 2.4 (Footnote 28): Change 'Guidance on developing privacy plans is forthcoming.' to 'Guidance on developing privacy and supply chain risk management plans is forthcoming.' | 9 | | 12-10-2020 | Editorial | Table 3-1 (AC-3(1)) Title: Change 'FUNCTION' to 'FUNCTIONS' | 16 | | 12-10-2020 | Editorial | Table 3-1 (AC-3(6)): Change 'MP-4, SC-28' to 'MP-4 and SC-28' | 16 | | 12-10-2020 | Editorial | Table 3-1 (AC-13): Change 'AC-2, AU-6' to 'AC-2 and AU-6' | 18 | | 12-10-2020 | Editorial | Table 3-1 (AC-19(5)) Title: Change 'FULL DEVICE AND' to 'FULL DEVICE OR' | 19 | | 12-10-2020 | Editorial | Table 3-1 (AC-20(4)) Title: Change 'NETWORK-ACCESSIBLE' to 'NETWORK ACCESSIBLE' | 19 | | 12-10-2020 | Editorial | Table 3-2 (AT-3(5)) Title: Change 'ACCESSING PERSONALLY' to 'PROCESSING PERSONALLY' | 20 | | 12-10-2020 | Editorial | Table 3-3 (AU-7(2)) Title: Change 'SEARCH AND SORT' to 'SORT AND SEARCH' | 21 | | 12-10-2020 | Editorial | Table 3-3 (AU-15): Change 'Incorporated into' to 'Moved to' | 22 |

Control Baselines for Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Stateless Hash-Based Digital Signature Standard:

This standard specifies the stateless hash-based digital signature algorithm (SLH-DSA). Digital signatures are used to detect unauthorized modifications to data and to authenticate the identity of the signatory. In addition, the recipient of signed data can use a digital signature as evidence in demonstrating to a third party that the signature was, in fact, generated by the claimed signatory. This is known as non-repudiation since the signatory cannot easily repudiate the signature at a later time. SLH-DSA is based on SPHINCS + , which was selected for standardization as part of the NIST Post-Quantum Cryptography Standardization process. 1. Name of Standard. Stateless Hash-Based Digital Signature Standard (FIPS 205). 2. Category of Standard. Computer Security. Subcategory. Cryptography. 3. Explanation. This standard specifies a stateless hash-based digital signature scheme (SLHDSA) for applications that require a digital signature rather than a written signature. Additional digital signature schemes are specified and approved in other NIST Special Publications and FIPS publications (e.g., FIPS 186-5 [1]). A digital signature is represented in a computer as a string of bits and computed using a set of rules and parameters that allow the identity of the signatory and the integrity of the data to be verified. Digital signatures may be generated on both stored and transmitted data. 7. Applications. A digital signature algorithm allows an entity to authenticate the integrity of signed data and the identity of the signatory. The recipient of a signed message can use a digital signature as evidence in demonstrating to a third party that the signature was, in fact, generated by the claimed signatory. This is known as non-repudiation since the signatory cannot easily repudiate the signature at a later time.

Stateless Hash-Based Digital Signature Standard


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Guidelines for Smart Grid Cybersecurity:

Impact Levels .......................................................... 76
Impact Levels for the CI&A Categories ......................................................................................
77
3.3
3.4  Selection of Security Requirements ............................................................................................. 79
3.5  Security Requirements Example .................................................................................................. 80
3.6  Recommended Security Requirements ........................................................................................ 81
3.7  Access Control (SG.AC) ............................................................................................................. 93
3.8  Awareness and Training (SG.AT) ............................................................................................. 107
3.9  Audit and Accountability (SG.AU) ........................................................................................... 111
3.10  Security Assessment and Authorization (SG.CA) ..................................................................... 120
3.11  Configuration Management (SG.CM) ....................................................................................... 124
3.12  Continuity of Operations (SG.CP) ............................................................................................. 132
3.13  Identification and Authentication (SG.IA) ................................................................................ 139
3.14  Information and Document Management (SG.ID) .................................................................... 142
3.15  Incident Response (SG.IR) ........................................................................................................ 146
3.16  Smart Grid Information System Development and Maintenance (SG.MA) ..............................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 3 – Discrete-based Manufacturing System Use Case:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications.  Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST.

Computer security; Cybersecurity Framework (CSF); distributed control systems (DCS); industrial control systems (ICS); information security; manufacturing; network security; programmable logic controllers (PLC); risk management; security controls; supervisory control and data acquisition (SCADA) systems.

The Executive Order 13636, 'Improving Critical Infrastructure Cybersecurity,' [1] directed the development of the voluntary Cybersecurity Framework that provides a prioritized, flexible, repeatable, performance-based, and cost-effective approach to manage cybersecurity risk [1] for those processes, information, and systems directly involved in the delivery of critical infrastructure services.

Cybersecurity Framework Manufacturing Profile Low Impact Level Example Implementations Guide_ Volume 3 – Discrete-based Manufacturing System Use Case


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Security Guidance for First Responder Mobile and Wearable Devices:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications.  Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST.

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and Technology  (NIST)  promotes  the  U.S.  economy  and  public  welfare  by  providing  technical leadership  for  the  Nation's  measurement  and  standards  infrastructure.  ITL  develops  tests,  test methods, reference data, proof of concept implementations, and technical analyses to advance the development  and  productive  use  of  information  technology.  ITL's  responsibilities  include  the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems.

- Section 2 provides an overview of the technology analyzed,
- Section 3 outlines the methodology used for analysis
- Section 4 summarizes the test plan and findings
- Section 5 suggests best practices and guidance for public safety mobile and wearable devices
- Section 6 concludes the document with a review of the document, future considerations, and other related NIST work
- Section 7 contains a list of references used in the development of this document

Security Guidance for First Responder Mobile and Wearable Devices


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Guidelines for the Authorization of Personal Identity Verification Card Issuers (PCI) and Derived PIV Credential Issuers (DPCI):

| 1. INTRODUCTION ...........................................................................................................................

Guidelines for the Authorization of Personal Identity Verification Card Issuers (PCI) and Derived PIV Credential Issuers (DPCI)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Guideline for Using Cryptographic Standards in the Federal Government_ Cryptographic Mechanisms:

asymmetric-key  algorithm;  identity  authentication;  confidentiality;  digital  signatures; encryption; integrity; key establishment; message authentication; random bit generation; symmetric-key algorithm.

Guideline for Using Cryptographic Standards in the Federal Government_ Cryptographic Mechanisms


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture provide? (Part 4)

[Assistant]
ble at https://csrc.nist.gov/pubs/sp/800/223/final, including related content, potential updates, and document history. All comments are subject to release under the Freedom of Information Act (FOIA).
## Abstract

Security is essential component of high-performance computing (HPC). HPC systems often differ based on the evolution of their system designs, the applications they run, and the missions they support. An HPC system may also have its own unique security requirements, follow different security guidance, and require tailored security solutions. Their complexity and uniqueness impede the sharing of security solutions and knowledge. This NIST Special Publication aims to standardize and facilitate the information and knowledge-sharing of HPC security using an HPC system reference architecture and key components as the basis of an HPC system lexicon. This publication also analyzes HPC threats, considers current HPC security postures and challenges, and makes best-practice recommendations. ## Keywords

high-performance computing; HPC reference architecture; HPC security; HPC security posture; HPC threat analysis; security guidance. ## Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems.

High-Performance Computing Security_ Architecture, Threat Analysis, and Security Posture


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP):

| title: "Apple macOS 11 (Big Sur) Test Baseline" description: | This guide describes the prudent actions to take when securing a system against the Test Baseline. authors: | |===                                                                                |
|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| profile:                                                                                |
| - section: "Authentication" rules: - auth_pam_login_smartcard_enforce - auth_pam_su_smartcard_enforce - auth_pam_sudo_smartcard_enforce - auth_smartcard_allow - section: "Auditing" rules: - audit_acls_files_configure - audit_acls_files_mode_configure - audit_acls_folder_wheel_configure |

- audit - OpenBSM 3
- auth - Smartcard authentication
- icloud - Apple's iCloud/Apple ID service
- os - Rules to configure the operating system that do not fit into the other categories
- pwpolicy - Password policy
- system\_settings or sysprefs - Settings controlled within the System Settings or System Preferences application

```
title: "Limit SSHD to FIPS 140 Validated Ciphers" discussion: | If SSHD is enabled, then it _MUST_ be configured to limit the ciphers to algorithms that are FIPS 140-validated. FIPS 140-2 is the current standard for validating that mechanisms used to access cryptographic modules utilize authentication that meets federal requirements. Operating systems utilizing encryption _MUST_ use FIPS-validated mechanisms for authenticating to cryptographic modules.

Automated Secure Configuration Guidance from the macOS Security Compliance Project (mSCP)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.1 (NIST 3.4.1)?

[Assistant]
According to PIV Card Application and Middleware Interface Test Guidelines (SP 800-73-4 Compliance):

3.4.1 2. 3.4.1 2. 3.4.1 2.

PIV Card Application and Middleware Interface Test Guidelines (SP 800-73-4 Compliance)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guidelines for the Authorization of Personal Identity Verification Card Issuers (PCI) and Derived PIV Credential Issuers (DPCI) provide? (Part 2)

[Assistant]
he requirements of the Office of Management and Budget (OMB) Circular A-130, Section 8b(3), Securing Agency Information Systems , as analyzed in Circular A-130, Appendix IV: Analysis of Key Sections .
Supplemental information is provided in Circular A-130, Appendix III, Security of Federal Automated Information Resources . Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on Federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other Federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST. ## National Institute of Standards and Technology Special Publication 800-79-2

Natl. Inst. Stand. Technol. Spec. Publ. 800-79-2, 120 pages (July 2015) http://dx.doi.org/10.6028/NIST.SP.800-79-2 CODEN: NSPUE2

This publication is available free of charge from:

http://dx.doi.org/10.6028/NIST.SP.800-79-2

Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to A Security Perspective on the Web3 Paradigm:

ugh smartphones, organizations had access to a myriad of sensor data, geolocation data, contact information, and stored media, all of which was made accessible through application permission requests.
As organizations continued to expand and collect user data, they also began to diversify their offerings. Many opened online storefronts that allowed users to purchase licenses to view digital media, such as music, books, and films. 1 Users could not easily migrate away from individual platforms since their licenses were specific to that platform. Some users found out too late that if they were removed from an organization's platform, they lost all access to the media for which they had purchased licenses [6]. In many cases, users were unable to return digital content that they were unhappy with or transfer digital content to other users (either a temporary transfer, such as lending to another user, or a permanent transfer, such as selling a digital item to another user). This change from the ownership of physical items to licenses to view digital content was seen by many as a step backwards. Proponents of Web3 saw the mass collection of user data, platform lock-in, and the inability to obtain and transfer the ownership of digital items as issues with Web 2.0.

A Security Perspective on the Web3 Paradigm


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for System and Communications Protection?

[Assistant]
According to Computer Security Division 2009 Annual Report:

| 33 33 | 33 33 | | | | Automated Combinatorial Testing for Software | | | | | 11 | Conformance Verification for Access Control | 34 | 34 | | Small and Medium Size Business Outreach | | Policies Forensics forWeb Services | 35 | 35 | | Health Information Technology Security | 11 | Mobile Handheld Device Security and Forensics | 35 | 35 | | | 12 | | | | | Smart Grid Cyber Security | 13 | NIST Cloud Computing Project Policy Machine | 36 36 | 36 36 | | Supply Chain Risk Management | 13 | Security for Grid and Pervasive Systems | 38 | 38 | | Cryptographic Validation Programs and Laboratory Accreditation | 14 14 | Security Ontologies: Modeling Quantitative Risk Analysis | | | | Laboratory Accreditation Cryptographic ModuleValidation Program and Cryptographic | | of Enterprise Systems | 38 | 38 | | Algorithm Validation Program | 15 16 | Automated Vulnerability Management National Vulnerability Database | 39 39 | 39 39 | | Automated Security Testing andTest Suite Development ISO Standardization of Cryptographic ModuleTesting | 18 18 | Security Content Automation Protocol | 39 | 39 |

Computer Security Division 2009 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.3 (NIST 3.3.3)?

[Assistant]
According to Automation Support for Security Control Assessments_ Volume 1_ Overview:

3.3.3 Using Security Capabilities in Security Control Assessment ... 3.3.3 Using Security Capabilities in Security Control Assessment

While the term security capability is defined in SP 800-53, no specific capabilities are identified, allowing organizations to define security capabilities according to security goals.

Automation Support for Security Control Assessments_ Volume 1_ Overview


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Secure Data Network Systems (SDNS) Network, Transport, and Message Security Protocols provide? (Part 5)

[Assistant]
results of this project include a set of specifications that include security services, protocols and mechanisms for protecting user data in networks that are based on the OSI computer network model.
Productive security services that protect user data are specified and supportive security services, such as key management and access control, are also provided. No cryptographic algorithms are included in these specifications. NIST is working with NSA and industry to identify and develop a framework of base standards for network security. In 1989, NIST established the OSI Security Laboratory where interested researchers from government and industry develop and demonstrate new ideas in network security. The major goals of NIST's network security activities are to:

- Identify and develop 'security standards for open systems
- Specify a key management system that supports these security standards
- Encourage the development of interoperable equipment

i'

i:

r<

<11

'

V-

'

.'T.^.X v. ^1

'

'

-

». *

^

L':

J

6»

•*»•!:•

».:c s-

.e trWOe

'i>sfi5^

'^9

j^;,

4 ':'

'v;

v ,; k*^t

E

^"<1^

s* * ^'f

'

4'3

'{Loti

{1.0*5

, 7'.^!::?^

1

*

?U>

.'?*'^6

n'^

''

bfTti iSr*

'

sT".p

-j, i':tvV

,-

.,

,:

bf^f^

/ti

::^0f.ri^'il^^7K'o-

«'

r Juxv'i'ii$> ,

-^s'

'=•''' I

19 . ^oO

:r'^^

\*;ti:;i,*'x i'

^' TSiI'A

sf XC-^Q

^ Er

X*;n,?v^'CV^

.'[i^QlXir^ftiit^

.[i^Qiziz^qtt v-'itiv#'! l&^£SmUl^tip'll

(XSiOCU)

tpffT

o"? ^sbodjnji palrisxXc!>i'? paxnsxxc^

IPI

,.:tos-tc!itq i«i?^*x'9naios^

bftjs

67j»

u

rt:rivj>#p

X4AO'li#fi>nri:s:*'nI

bfijs

U'*

f-.4. io

:^Ai»itn'^vox<

XAnai^ilV, ainaantiboL

fUKxtu^v i#o

'i-V'.f

@- timc^i:^$s%f

^dsi- ^

^

fi«? •

*i'

,

ui&.^ijj-.*5ti

^*«il-l'

J«3Si»r..n;

foi-*fe io

:io

!IP

«b7tf:»bfi4^5i

-pii

9u:ic^s0%

ft/r^ xA

iAO'ist y#i|

6 -" 6

-f.bl

-aroenoga

%f i ia%f

:

:?

Secure Data Network Systems (SDNS) Network, Transport, and Message Security Protocols


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for System and Information Integrity?

[Assistant]
According to A Methodology for Enabling Forensic Analysis Using Hypervisor Vulnerabilities Data:

- [ 0] swapper/0 (struct addr:ffffffff81e13500) - [ 1] systemd (struct addr:ffff88007c460000) - [ 2] kthreadd (struct addr:ffff88007c460e00) - [ 3] ksoftirqd/0 (struct addr:ffff88007c461c00) - [ 4] kworker/0:0 (struct addr:ffff88007c462a00) - [ 5] kworker/0:0H (struct addr:ffff88007c463800) - [ 6] kworker/u2:0 (struct addr:ffff88007c464600) - [ 7] rcu\_sched (struct addr:ffff88007c465400) - [ 8] rcu\_bh (struct addr:ffff88007c466200) - [ 9] migration/0 (struct addr:ffff88007c467000) - [ 10] watchdog/0 (struct addr:ffff88007c4c8000) - [ 11] kdevtmpfs (struct addr:ffff88007c4c8e00) - [ 12] netns (struct addr:ffff88007c4c9c00) - [ 13] perf (struct addr:ffff88007c4caa00) - [ 14] xenwatch (struct addr:ffff88007c4cb800) - [ 15] xenbus (struct addr:ffff88007c4cc600) - [ 16] khungtaskd (struct addr:ffff88007c4cd400) - [ 17] writeback (struct addr:ffff88007c4ce200) - [ 18] ksmd (struct addr:ffff88007c4cf000) - [ 19] crypto (struct addr:ffff88007c568000) - [ 20] kintegrityd (struct addr:ffff88007c568e00) - [ 21] bioset (struct addr:ffff88007c569c00) - [ 22] kblockd (struct addr:ffff88007c56aa00) - [ 23] ata\_sff (struct addr:ffff88007c56b800) - [ 24] md (struct addr:ffff88007c56c600) - [ 25] devfreq\_wq (struct addr:ffff88007c56d400) - [ 26] kworker/0:1 (struct addr:ffff88007c56e200) - [ 27] kworker/u2:1 (struct addr:ffff88007c56f000) - [ 29] kswapd0 (struct addr:ffff880076060e00) - [ 30] vmstat (struct addr:ffff880076061c00) - [ 31] fsnotify\_mark (struct addr:ffff880076062a00) - [ 32] ecryptfs-kthrea (struct addr:ffff880076063800) - [ 48] kthrotld (struct addr:ffff880076131c00) - [

A Methodology for Enabling Forensic Analysis Using Hypervisor Vulnerabilities Data


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Security Architecture Design Process for Health Information Exchanges (HIEs):

|
| Federal Regulations: Initial Set of Standards, Implementation Specifications, and Certification Criteria for Electronic Health Record Technology, 45 CFR Part 170 (Interim Final Rule) | Eligible professionals and eligible hospitals under the Medicare and Medicaid EHR Incentive Programs                                                                                | Risk Assessment; Secured Communication Channel; Document Confidentiality; Manage Consent Directives | The interim final rule became effective February 12, 2010. It adopts an initial set of standards, implementation specifications, and certification criteria, as required by section 3004(b)(1) of the Public Health Service Act. It represents the first step in an incremental approach to adopting standards, implementation specifications, and certification criteria to enhance the interoperability, functionality, utility, and security of health information technology and to support its meaningful use. |
| Federal Regulations: Protection of Human Subjects, 45 CFR Part 46 ('The Common Rule' for Human Subjects Protection)                                                                    | Any institution conducting research involving human subjects conducted, supported, or otherwise subject to regulation by any federal department or agency                                                                  | Risk Assessment; Document Confidentiality; Manage Consent Directives; De- Identification            | Requires consent of research subjects, subject to some exemptions, including research on records where if the information is recorded by the investigator in such a manner that subjects cannot be identified, directly or through identifiers linked to the subjects. Consent forms must include notice of adequate provisions to protect the privacy of subjects and to maintain the confidentiality of data.

Security Architecture Design Process for Health Information Exchanges (HIEs)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Interfaces for Personal Identity Verification_ Part 3 – PIV Client Application Programming Interface:

authentication; FIPS 201; identity credential; logical access control; on-card biometric comparison; Personal Identity Verification (PIV); physical access control; smart cards; secure messaging. The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in Federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. Homeland Security Presidential Directive-12 (HSPD-12) called for the adoption of a common identification standard to govern the interoperable use of identity credentials to allow physical and logical access to federally controlled facilities and information systems. In response, Federal Information Processing Standard (FIPS) 201 [FIPS201], Personal Identity Verification (PIV) of Federal Employees and Contractors , was developed to define reliable, government-wide identity credentials for use in applications such as access to federally controlled facilities and information systems. FIPS 201 supports multiple types of authenticators, including authenticators on smart cards (also known as PIV Cards) and derived PIV credential authenticators in various other form factors. This publication contains technical specifications to interface with PIV Cards to retrieve and use identity credentials.

Interfaces for Personal Identity Verification_ Part 3 – PIV Client Application Programming Interface


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Audit and Accountability?

[Assistant]
According to Assessing Enhanced Security Requirements for Controlled Unclassified Information:

| CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... | 1   |
|-----------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------|-----|
| 1.1                                                                                | PURPOSEANDAPPLICABILITY............................................................................................................. 1        | 2   |
| 1.2                                                                                | TARGET AUDIENCE.............................................................................................................................. |     |
| 1.3                                                                                | ORGANIZATIONOF THIS SPECIAL PUBLICATION................................................................................. | 2   |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ | CHAPTERTWO THE FUNDAMENTALS............................................................................................ | 3   |
| 2.1                                                                                | ASSESSMENT PROCEDURES................................................................................................................

Assessing Enhanced Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to NIST Cloud Computing Forensic Reference Architecture:

civil litigation; criminal investigation; cybersecurity; digital forensics; enterprise architecture; enterprise operations; forensic readiness; incident response.

New methodologies are needed to identify, acquire, preserve, examine, and interpret digital evidence in multi-tenant cloud environments with rapid provisioning, global elasticity, and broad network accessibility. These methodologies will provide capabilities for incident response, secure internal enterprise operations, and support for the criminal justice and civil litigation systems.

The NIST Cloud Computing Forensic Science Working Group (NCC FSWG) was established to research forensic science challenges and architectures related to the cloud environment. It previously published NIST Interagency Report (IR) 8006, NIST Cloud Computing Forensic Science Challenges [1], which highlighted the unique digital forensic challenges of public cloud computing services under three aspects of operation: normal operations, adverse operations (i.e., when cloud computing resources are under attack), and operations during criminal exploitation. A description and discussion of digital forensics in cloud computing is provided in Section 1.1.

NIST Cloud Computing Forensic Reference Architecture


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Security Content Automation Protocol (SCAP) Version 1.3 Validation Program Test Requirements:

This report defines the requirements and associated test procedures necessary for products or modules to achieve one or more Security Content Automation Protocol (SCAP) validations. Validation is awarded based on a defined set of SCAP capabilities by independent laboratories that have been accredited for SCAP testing by the NIST National Voluntary Laboratory Accreditation Program (NVLAP). This publication is intended for NVLAP accredited laboratories conducting SCAP product and module testing for the program, vendors interested in receiving SCAP validation for their products or modules, and organizations deploying SCAP products in their environments. Accredited laboratories use the information in this report to guide their testing and ensure all necessary requirements are met by a product before recommending to NIST that the product be awarded the requested validation. Vendors may use the information in this report to understand the features that products and modules need to be considered for SCAP validation. Government agencies and integrators use the information to gain insight into the criteria required for SCAP validated products. The secondary audience for this publication includes end users, who can review the test requirements to understand the capabilities of SCAP validated products and gain knowledge about SCAP validation. The National Institute of Standards and Technology (NIST) Security Content Automation Protocol (SCAP) Validation Program tests the ability of products and modules to use the features and functionality available through SCAP and its components. SCAP 1.3 consists of a suite of specifications for standardizing the format and nomenclature by which security software communicates information about software flaws and security configurations. The standardization of security information facilitates interoperability and enables predictable results among disparate SCAP enabled security software.

Security Content Automation Protocol (SCAP) Version 1.3 Validation Program Test Requirements


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] How does The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.1 support CMMC certification?

[Assistant]
According to The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.1:

<!-- image -->

## The Technical Specification for the Security Content Automation Protocol (SCAP): SCAP Version 1.1

## Recommendations of the National Institute of Standards and Technology

David Waltermire Stephen Quinn Karen Scarfone

NIST Special Publication 800-126 Revision 1

The Technical Specification for the Security Content Automation Protocol (SCAP): SCAP Version 1.1

Recommendations of the National Institute of Standards and Technology

David Waltermire Stephen Quinn Karen Scarfone

## C  O  M  P  U  T  E  R      S  E  C  U  R  I  T  Y

Computer Security Division Information Technology Laboratory National Institute of Standards and Technology Gaithersburg, MD 20899-8930

February 2011

<!-- image -->

U.S. Department of Commerce

Gary Locke, Secretary

National Institute of Standards and Technology

Dr. Patrick D. Gallagher, Director

## Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analysis to advance the development and productive use of information technology. ITL's responsibilities include the development of technical, physical, administrative, and management standards and guidelines for the cost-effective security and privacy of sensitive unclassified information in Federal computer systems. This Special Publication 800-series reports on ITL's research, guidance, and outreach efforts in computer security and its collaborative activities with industry, government, and academic organizations. National Institute of Standards and Technology Special Publication 800-126, Revision 1 39 pages (Feb.

The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.1


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Measurement Guide for Information Security_ Volume 2 — Developing an Information Security Measurement Program:

..................................................8                                                                                |
| 2.4.5.
Other Roles...................................................................................................................................8                                                                                |
| 2.7.1. Organizational Considerations ...................................................................................................11                                                                                |
| 2.7.2. Manageability.............................................................................................................................11                                                                                |
| 2.7.3. Data Management Concerns......................................................................................................11                                                                                |
| 3. Workflow for Implementing an Information Security Measurement Program ................................12                                                                                |
| 3.1.1. Gathering Stakeholder Input......................................................................................................14                                                                                |
| 3.1.2. Goals and Objectives..................................................................................................................14 3.1.3.

Measurement Guide for Information Security_ Volume 2 — Developing an Information Security Measurement Program


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Cybersecurity Framework Version 1.1 Manufacturing Profile:

Manufacturing industries are usually located within a confined factory or plant-centric area. Communications in manufacturing industries are typically performed using fieldbus and local area network (LAN) technologies that are reliable and high speed. Wireless networking technologies are gaining popularity in manufacturing industries. Fieldbus includes, for example, DeviceNet, Modbus, and Controller Area Network (CAN) bus.

Cybersecurity Framework Version 1.1 Manufacturing Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Information Security Guide for Government Executives provide? (Part 4)

[Assistant]
ides a broad overview of information security program concepts to assist senior leaders in understanding how to oversee and support the development and implementation of information security programs.
Senior management is responsible for:

- Establishing the organization's information security program;
- Setting program goals and priorities that support the mission of the organization; and
- Making sure resources are available to support the information security program and make it successful. Senior leadership commitment to information security is more important now than ever before. Studies have shown that senior management's commitment to information security initiatives is the single most critical element that impacts an information security program's success. Organizational assets and operations have become increasingly dependent on information and technology to accomplish mission and performance goals. Recognizing this dependency, information becomes a strategic enabler for mission accomplishment; therefore, protecting that information becomes a high priority of an organization. Meeting this need necessitates senior leadership focus on effective information security governance and support, which requires integration of security into the strategic and daily operations of an organization. When considering this challenge, several key security questions emerge for the executive. This document will answers these questions and provides strategies to aid senior leaders in implementing an effective information security program. 1. Why do I need to invest in information security? 2. Where do I need to focus my attention in accomplishing critical information security goals? 3. What are the key activities to build an effective information security program? 4. What are the information security laws, regulations, standards, and guidance that I need to understand to build an effective security program? 5.

Information Security Guide for Government Executives


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Automation Support for Security Control Assessments_ Software Asset Management provide? (Part 5)

[Assistant] Software Asset Management (SWAM) Capability Definition, Overview, and Scope.........3 | | 2.1 SWAM Capability Description ...............................................................................................3 | | 2.2 SWAM Attack Scenarios and Desired Result..........................................................................7 | | 2.3 Assessment Objects Protected and Assessed by SWAM.........................................................9 | | 2.4 Example SWAM Data Requirements ....................................................................................14 | | 2.5 SWAM Concept of Operational Implementation ..................................................................16 | | 2.5.1 Collect Actual State.........................................................................................................16 | | 2.5.2 Collect Desired State ......................................................................................................17 | | 2.5.3 Find/Prioritize Defects....................................................................................................18 | | 2.6 SP 800-53 Control Items that Support SWAM .....................................................................18 | | 2.6.1 Process for Identifying Needed Controls........................................................................18 | | 2.6.2 Control Item Nomenclature ............................................................................................19 | | 2.7 SWAM Specific Roles and Responsibilities ..........................................................................20 | | 2.8 SWAM Assessment Boundary ...............................................................................................22 | | 2.9 SWAM Actual State and Desired State Specification ...........................................................22 | | 2.10 SWAM Authorization Boundary and Inheritance...............................................................23 | | 2.12 SWAM Assessment Criteria Device Groupings to Consider | | 2.11 SWAM Assessment Criteria Recommended Scores and Risk-Acceptance Thresholds.......23 | | ..............................................23 | | 3.1 Introduction and Steps for Adapting This Plan....................................................................24 | | 3.1.1 Select Defect Checks to Automate...................................................................................24 | | 3.1.3 Automate Selected Defect Checks...................................................................................26 | | 3.2 SWAM Sub-Capabilities and Defect Check Tables and Templates......................................27 | |----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 3.2.1 Foundational Sub-Capabilities and Corresponding Defect

Automation Support for Security Control Assessments_ Software Asset Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Guide to Storage Encryption Technologies for End User Devices:

| Executive Summary..............................................................................................................ES-1   | Executive Summary..............................................................................................................ES-1    | Executive Summary..............................................................................................................ES-1    | Executive Summary..............................................................................................................ES-1    |
|---------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|
| 1.

Guide to Storage Encryption Technologies for End User Devices


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Secure Data Network Systems (SDNS) Network, Transport, and Message Security Protocols:

nated with another SNICP at an intermediate system, then the data origin authentication is supplied by a combination of key management and explicit protection of source and destination NSAP addresses.
This protocol can support the access control service described in ISO 7498/2 using security labeling and using attributes associated with cryptographic keys. This protocol can support the peer entity authentication and data origin authentication services described in ISO 7498/2 using attributes associated with cryptographic keys.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to COTS Security Protection Profile - Operating Systems (CSPP-OS) (Worked Example Applying Guidance of NISTIR-6462, CSPP) Version 1.0:

| TABLE | PAGE | |--------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------| | TABLE 3.2-1 - SECURITY ASSUMPTIONS - TOE.....................................................................................................................7 | | | TABLE 3.2-2 - SECURITY ASSUMPTIONS - PERSONNEL..........................................................................................................7 | | | TABLE 3.3-1 - SECURITY POLICIES........................................................................................................................................8 | | | TABLE 3.4-1 - SECURITY THREATS ADDRESSED BY TOE'S ENVIRONMENT ........................................................................11 | | | TABLE 3.4-2 - SECURITY THREATS ADDRESSED BY TOE....................................................................................................12 | | | TABLE 3.4-3 - SECURITY THREATS ADDRESSED JOINTLY BY TOE AND ENVIRONMENT .....................................................13 | | | TABLE 4-1 - ENVIRONMENTAL SECURITY OBJECTIVES ......................................................................................................22 | | | TABLE 4-2 - TOE SECURITY OBJECTIVES ..........................................................................................................................25 | | | TABLE 4-3 - JOINT TOE/ENVIRONMENT SECURITY OBJECTIVES ........................................................................................27 | | | TABLE 5-1 - FUNCTIONAL COMPONENTS - TOE.................................................................................................................29 | | | TABLE 5-2 - FUNCTIONAL COMPONENTS - IT ENVIRONMENT ............................................................................................34 | | | TABLE 5-3 - SOF METRICS - TOE......................................................................................................................................36 | | | TABLE 5-4 - SOF METRICS - IT ENVIRONMENT.................................................................................................................38 | | | TABLE 6-1 - EAL-CSPP ASSURANCE COMPONENTS..........................................................................................................39 | | | TABLE 6-2 - EAL-CSPP AUGMENTATION TO EAL-2 .........................................................................................................40 | |

COTS Security Protection Profile - Operating Systems (CSPP-OS) (Worked Example Applying Guidance of NISTIR-6462, CSPP) Version 1.0


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Guidelines on PDA Forensics:

nciples aim to ensure the integrity and accountability of digital evidence through its entire life cycle. Proper handling of evidence is always vital for it to be admissible in  judicial  proceedings.
However,  different  standards  may  apply  to  different  types  of investigations. The degree of training and expertise required to execute a forensic task largely depends on the level of evidence required in the case [Pur].


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Hardware-Enabled Security_ Enabling a Layered Approach to Platform Security for Cloud and Edge Computing Use Cases:

5                                                                                |
|                                                                                | 3.2 The Chain of Trust                                                                                | (CoT)................................................................................ 6                                                                                |
|                                                                                | 3.3                                                                                | Supply Chain Protection .................................................................................

Hardware-Enabled Security_ Enabling a Layered Approach to Platform Security for Cloud and Edge Computing Use Cases


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.4 (NIST 3.1.4)?

[Assistant]
According to Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations:

3.1.4. 3.1.4 DEFINE SAMPLE POPULATIONS

Organizations may find that collecting data from every object of every system within  an organization may be impractical or cost-prohibitive.

Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.2 (NIST 3.3.2)?

[Assistant]
According to Guide to Cyber Threat Information Sharing:

3.3.2 of NIST Special Publication 800-61 [1].

Guide to Cyber Threat Information Sharing


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IA.L2-3.5.2 (NIST 3.5.2)?

[Assistant]
According to Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology:

3.5.2 Maintenance Plans for Scenario 2, Emergency Patching... 3.5.2 Maintenance Plans for Scenario 2, Emergency Patching

Organizations should consider using the same general approach for emergency patching as for routine patching, except with a highly accelerated schedule.

Guide to Enterprise Patch Management Planning_ Preventive Maintenance for Technology


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Case Studies in Cyber Supply Chain Risk Management_ Anonymous Consumer Electronics Company provide? (Part 5)

[Assistant]
ort potential risks to leadership. The information security team enforces the principle of least privilege, and the user base has historically been enthusiastic about new security tools and processes.
## Supplier Management

## Key Aspects of Managing Supplier Relationships

Strong supplier relationships are a core element of the Consumer Electronics Company's supply chain management. The company deliberately fosters formal and personal relationships with all partners and suppliers and has worked with some suppliers for over a decade. This personal approach helps build a better mutual understanding of each business and strong trust over time. To maintain these relationships, the company's employees perform informal touchpoints and attend regular on-site meetings with each supplier. These meetings occur quarterly for some critical suppliers. Relationships are managed directly by the development team responsible for the ultimate product. Whenever possible, the Consumer Electronics Company will source new components from existing suppliers to minimize complexity and strengthen existing relationships. When new vendors are required, the Global Sourcing team will perform an assessment of the new supplier's security practices. These assessments are largely driven by the company's experience with supply chain incidents, cyber hygiene best practices, and conformance with security requirements from the U.S. Customs and Border Protection's (CBP) Customs-Trade Partnership Against Terrorism i  (CTPAT) program. CTPAT is the Department of Homeland Security's largest public-private partnership for supply chain risk management. The voluntary program grants the Consumer Electronics Company a low-risk customs designation for demonstrating compliance with a broad range of supply chain security assurances, including secure transit and storage, personnel controls, and IT security.

Case Studies in Cyber Supply Chain Risk Management_ Anonymous Consumer Electronics Company

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Supply Chain Risk Management
Maintenance
System and Communications Protection
Security Assessment
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.2 (NIST 3.1.2)?

[Assistant]
According to Guidelines for Securing Radio Frequency Identification (RFID) Systems:

3.1.2                                                                                | Tracking... 3.1.2 Power Source

Tags need power to perform functions such as sending radio signals to a reader, storing and retrieving data, and performing other computations (e. 3.1.2 Tracking

Tracking applications are used to identify the location of an item, or more accurately, the location of the last reader that detected the presence of the tag associated with the item.

Guidelines for Securing Radio Frequency Identification (RFID) Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Guide to Information Technology Security Services:

-  Develop processes and procedures that can effectively track the myriad service agreements and the metrics that will be applied throughout the lifecycle of the many different and disparate IT security services within an organization | Types | of Services.............................................................................................................5-1 | of Services.............................................................................................................5-1 | |---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | 5.1 | | Management Security Services ...............................................................................5-2 | | | 5.1.1 | IT Security Program Development ...............................................................5-2 | | | 5.1.2 | IT Security Policy..........................................................................................5-3 | | | 5.1.3 | Risk Management ........................................................................................5-4 | | | 5.1.4 | IT Security Architecture ................................................................................5-4 | | | 5.1.5 | Certification and Accreditation......................................................................5-4 | | | 5.1.6 | IT Security Product Evaluation.....................................................................5-5 | | 5.2 | Operational Security Services..................................................................................5-6 | Operational Security Services..................................................................................5-6 | | | 5.2.1 | Contingency Planning ..................................................................................5-6 | | | 5.2.2 | Incident Handling..........................................................................................5-7 | | | 5.2.3 | Testing..........................................................................................................5-8 | | | 5.2.4 | Training ........................................................................................................5-9 | | 5.3 | Technical Security Services...................................................................................5-11 | Technical Security Services...................................................................................5-11 | | | 5.3.1 | Firewalls .....................................................................................................5-11 | | | 5.3.2 | Intrusion Detection .....................................................................................5-11 | | | 5.3.3 | Public Key Infrastructure ............................................................................5-12 | | Appendix A-REFERENCES.................................................................................................A-1 | Appendix A-REFERENCES.................................................................................................A-1 | Appendix A-REFERENCES.................................................................................................A-1 | | Appendix B-ACRONYM LIST..............................................................................................B-1 | Appendix B-ACRONYM LIST..............................................................................................B-1 |

Guide to Information Technology Security Services


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to 1989 Computer Security and Privacy Plans (CSPP) Review Project_ A First-Year Federal Response to the Computer Security Act of 1987 (Final Report):

| . | . | . . | III-17        |
| III-13        | Physical/Environmental Protection-GADPS                                    |                                    | . | . | .
| III-17        |
| III-14        | Controls-GADPS                                                             |                                    |        |      |      | III-17        |
| III-15        | Production, I/O Emergency, Backup, and Cont. Planning-GADPS                |                                    |        |      |      | III-18        |
| III-16        | Software and Maintenance-GADPS                                             | . | . | . | . | III-18        |
| III-17        | System Security Awareness and Training-GADPS                               | . | . | . | . | III-18        |
| III-18 III-19 | Authorization and Access Controls-GADPS Audit Trail Mechanisms-GADPS       |                                    | . . | . . | . . | III-19 III-19 |
| III-20        | Confidentiality Controls-GADPS                                             |                                    |        |      |      | III-19        |
| III-21        | Integrity Controls-GADPS                                                   |                                    |        |      |      | III-20        |
| III-22        | User                                                                       | Identification/Authorization-GADPS | . | . | . | III-20        |
| III-23        | Assignment Security Responsibility-MAS                                     |                                    |        | . | . | III-22        |
| III-24        | Personnel Screening-MAS . | . |        | . | .

1989 Computer Security and Privacy Plans (CSPP) Review Project_ A First-Year Federal Response to the Computer Security Act of 1987 (Final Report)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Ascon-Based Lightweight Cryptography Standards for Constrained Devices_ Authenticated Encryption, Hash, and Extendable Output Functions:

## Ascon-Based Lightweight Cryptography Standards for Constrained Devices

Authenticated Encryption, Hash, and Extendable Output Functions

## Ascon-Based Lightweight Cryptography Standards for Constrained Devices

Ascon-Based Lightweight Cryptography Standards for Constrained Devices_ Authenticated Encryption, Hash, and Extendable Output Functions


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Interagency Report on the Status of International Cybersecurity Standardization for the Internet of Things (IoT):

Alice has decided to travel outside of the United States but is diabetic and wants to monitor her blood glucose levels and receive updates on her condition from her primary care provider.

As Figure 7 shows, Alice has a wirelessenabled wearable glucose monitor and injection device (insulin pump). Blood sugar data reflecting the results of Alice's advanced diabetes treatments which are being evaluated will be published electronically and provided to her after they are processed via intelligent computing technologies. Clinicians then will proactively evaluate and personalize her treatment, sending predictive alerts for hypoglycemia and insulin dosage updates.

The GSA Headquarters Building includes over 750,000 square feet of space, two-thirds of which has been modernized. The structure incorporates a variety of smart building technologies to help its occupants work comfortably, while improving energy efficiency and achieving mandatory sustainability goals. The various technology components form an integrated automated environment (see Table 2 for an illustrative listing), that helps building and facilities managers achieve their goals of occupant satisfaction, energy use intensity, maintenance costs, water usage, and CO2 emissions.

Interagency Report on the Status of International Cybersecurity Standardization for the Internet of Things (IoT)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.1 (NIST 3.2.1)?

[Assistant]
According to Interfaces for Personal Identity Verification_ Part 1 – PIV Card Application Namespace, Data Model and Representation:

3.2.1. 3.2.1) • Added Key History capability (Part 1, Sec.

Interfaces for Personal Identity Verification_ Part 1 – PIV Card Application Namespace, Data Model and Representation


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to 1989 Computer Security and Privacy Plans (CSPP) Review Project_ A First-Year Federal Response to the Computer Security Act of 1987 (Final Report):

- 1) Agency management should ensure that computer security has the highest level of management involvement. This involvement is also important in the computer security planning process. Computer security benefits from the multiple perspectives of and input from agency IRM, computer security, and functional, user, and applications personnel
- 2) Agency management should identify and describe the security needs of their systems which contain sensitive information. - 3) Agency management should recognize the importance of computer security and its required planning. This recognition should be aggressively communicated to their staffs, perhaps using their computer security and awareness training programs as one of the vehicles. - 4) Agencies should incorporate computer security planning with other information systems planning activities. - 5) Agencies should consider the protection requirements for integrity and availability on an equal basis with that of confidentiality. - 6) Agencies should assess risks and select and implement realistic controls throughout the system life cycle. This involves awareness of technology changes with regard system hardware and software. This awareness also requires a knowledge of new technology and new methods for protecting and recovering from system threats. | III- 1        | Civilian Agency CSPP Distribution by Branch Government                     | of                                 | of     | of   | of   | of            |
|---------------|----------------------------------------------------------------------------|------------------------------------|--------|------|------|---------------|
|               | . |                                    |        |      | . | III-4         |
| III- 2 III-   | Distribution of CSPPs by System Category Distribution of CSPPs Operational |                                    | . | . | . . | III-6 .


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Framework for Improving Critical Infrastructure Cybersecurity, Version 1.0 provide? (Part 2)

[Assistant]
19           | List of Tables 1: Function and Category Unique Identifiers ..................................................................... 19           |
| Table Table 2: Framework Core............................................................................................................. | 20                                                                                |

## Executive Summary

The national and economic security of the United States depends on the reliable functioning of critical infrastructure. Cybersecurity threats exploit the increased complexity and connectivity of critical infrastructure systems, placing the Nation's security, economy, and public safety and health at risk. Similar to financial and reputational risk, cybersecurity risk affects a company's bottom line. It can drive up costs and impact revenue. It can harm an organization's ability to innovate and to gain and maintain customers. To better address these risks, the President issued Executive Order 13636, 'Improving Critical Infrastructure Cybersecurity,' on February 12, 2013, which established that '[i]t is the Policy of the United States to enhance the security and resilience of the Nation's critical infrastructure and to maintain a cyber environment that encourages efficiency, innovation, and economic prosperity while promoting safety, security, business confidentiality, privacy, and civil liberties.' In enacting this policy, the Executive Order calls for the development of a voluntary risk-based Cybersecurity Framework - a set of industry standards and best practices to help organizations manage cybersecurity risks. The resulting Framework, created through collaboration between government and the private sector, uses a common language to address and manage cybersecurity risk in a cost-effective way based on business needs without placing additional regulatory requirements on businesses.

Framework for Improving Critical Infrastructure Cybersecurity, Version 1.0


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Approaches for Federal Agencies to Use the Cybersecurity Framework provide? (Part 3)

[Assistant]
astructure. ITL  develops  tests,  test methods, reference data, proof of concept implementations, and technical analyses to advance the development  and  productive  use  of  information  technology.
ITL's  responsibilities  include  the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. ## Abstract

The  document  highlights  examples  for  implementing  the Framework  for  Improving  Critical Infrastructure  Cybersecurity (known  as  the  Cybersecurity  Framework)  in  a  manner  that complements the use of other NIST security and privacy risk management standards, guidelines, and  practices. These  examples  include  support  for  an  Enterprise  Risk  Management  (ERM) approach  in  alignment  with  OMB  and  FISMA  requirements  that  agency  heads  'manage  risk commensurate  with  the  magnitude  of  harm  that  would  result  from  unauthorized  access,  use, disclosure,  disruption,  modification,  or  destruction  of  a  federal  information  system  or  federal information.' The use of the Cybersecurity Framework's components enable discussion about the various types of risk that might occur within federal organizations and promote conversations about how to determine the likelihood and potential consequences of risk events. These activities can then be combined with those described in NIST Special Publication (SP) 800-37, Revision 2, Risk Management Framework for Information Systems and Organizations ; SP 800-39, Managing Information Security Risk ; and other guidelines to form a comprehensive risk-based approach for security and privacy. This  risk-based  approach  will  assist  agencies  in  determining  the  risks  that  are  relevant  to  its mission throughout the operational lifecycle and apply an appropriate type and degree of resources to treat those risks to an acceptable level.

Approaches for Federal Agencies to Use the Cybersecurity Framework


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Security Considerations for Code Signing:

A wide range of software products (also known as code)-including firmware, operating systems, mobile  applications,  and  application  container  images-must  be  distributed  and  updated  in  a secure and automatic way to prevent forgery and tampering. Digitally signing code provides both data integrity to prove that the code was not modified, and source authentication to identify who signed  the  code. This  paper  describes  features  and  architectural  relationships  of  typical  code signing solutions that are widely deployed today. It defines code signing use cases and identifies some security problems that can arise when applying code signing solutions to those use cases. Finally,  it  provides  recommendations  for  avoiding  those  problems  and  resources  for  more information. An effective and common method of protecting software is to apply a digital signature to the code. Digitally signing code provides both data integrity to prove that the code was not modified, and source authentication to identify who was in control of the code at the time it was signed. When the recipient verifies the signature, he is assured that the code came from the source that signed it, and that it has not been modified in transit. The signer is the entity responsible for managing the keys used to sign software. This role may be performed by the same organization that developed or built the software, or by an independent party in a position to vouch for the source of the code. The signer generates the code signing private/public key pair on a device that is sufficiently protected, as the security of this process relies upon the protection of the private key. In many cases, the signer then provides the public key to a certification authority (CA) through a certificate signing request. The CA will confirm the signer's identity and provides a signed certificate that ties the signer to the provided public key.

Security Considerations for Code Signing


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Guide to SSL VPNs:

Introduction ......................................................................................................................1-1 | | | | 1.1 | Authority...................................................................................................................1-1 | | | | 1.2 | Purpose and Scope .................................................................................................1-1 | | | | 1.3 | Audience..................................................................................................................1-1 | | | | 1.4 | Document Structure.................................................................................................1-1 | | | 2.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Ascon-Based Lightweight Cryptography Standards for Constrained Devices_ Authenticated Encryption, Hash, and Extendable Output Functions provide? (Part 2)

[Assistant]
ts, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.
Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications

## Authority

This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the ORCID, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST. ## NIST Technical Series Policies

Copyright, Use, and Licensing Statements NIST Technical Series Publication Identifier Syntax

## Publication History

Approved by the NIST Editorial Review Board on 2025-07-09

## How to cite this NIST Technical Series Publication:

Meltem Sönmez Turan, Kerry A.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Guidelines for Smart Grid Cybersecurity:

EXECUTIVE SUMMARY .................................................................................................................. IX
Content of the Report ............................................................................................................................ xi
 CHAPTER 1   DOCUMENT DEVELOPMENT STRATEGY ...................................................................1
1.1  Cybersecurity and the Electric Sector ............................................................................................ 4
1.2  Scope and Definitions .................................................................................................................... 5
1.3  Smart Grid Cybersecurity Document Development Strategy ........................................................ 6
1.4  Combined Cyber-Physical Attacks .............................................................................................. 12
 CHAPTER 2   LOGICAL ARCHITECTURE AND INTERFACES OF THE SMART GRID ......................14
2.1  The Seven Domains to the Logical Reference Model ................................................................. 15
2.2  Logical Security Architecture Overview ..................................................................................... 24
2.3  Logical Interface Categories ........................................................................................................ 28
 CHAPTER 3  HIGH-LEVEL SECURITY REQUIREMENTS ...............................................................75
3.1  Cybersecurity Objectives ............................................................................................................. 75
3.2  Confidentiality, Integrity, and Availability Impact Levels .......................................................... 76
Impact Levels for the CI&A Categories ......................................................................................